United Kingdom: Children & Vulnerable Groups

The UK sets the digital age of consent for Information Society Services (ISS) at 13 under Art. 8 UK GDPR and s.9 DPA 2018 (where a child is under 13 and the controller relies on consent, parental responsibility holder authorisation is required). Beyond Art. 8 consent, the statutory Age Appropriate Design Code (Children's Code, issued under s.123 DPA 2018 and in force since September 2021) applies to ALL online services 'likely to be accessed by children' under 18 regardless of lawful basis, mandating 15 standards anchored in the best interests of the child: high privacy by default, geolocation off by default, minimal data collection, no nudge techniques, and a default prohibition on profiling children for behavioural advertising. From 5 February 2026, DUAA 2025 s.81 inserts Art. 25(1B) UK GDPR (' children's higher protection matters'), requiring providers of ISS likely to be accessed by children explicitly to embed children's higher protection into Art. 25 Data Protection by Design and by Default assessments. Active enforcement is demonstrated by the ICO's £14.47 million fine against Reddit, Inc. on 23 February 2026 for unlawful processing of under-13s' data, failure to deploy effective age assurance, and failure to complete a Children's Code DPIA, alongside parallel Ofcom age-assurance enforcement under the Online Safety Act 2023.